← Database

CVE-2026-125395

MEDIUM CVSS: 5.4 Published: 2026-11-10 Modified: 2026-11-10

Description

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

Affected Platforms

Unknown

Weakness Type

CWE-79

References